Auditing Automation Accounts

Question

Hello,

I want to audit the executions of runbooks in an automation account, when i check the activity logs, i don't see who executed the runbooks...Etc
Is there a way to have this information?

Thanks

Answer 1

Hi @Mohamed jihad bayali ,

I have followed below steps and was successfully able to find who executes which runbook. See if it helps you.

1. As shown in below screenshot, configured diagnostic setting in Azure Automation account such that audit categorygroup or AuditEvent category is selected and destination is selected to send audit events to log analytics workspace.

2. Then, executed a runbook from the same Azure Automation account and could see that the execution was completed as shown in below screenshot.

3. As mentioned here, I have waited for ~15 minutes after the above event is performed so that logs can be streamed to the specified destinations. Then I could see the audit event as shown in below screenshot which has clientInfo_ObjectId_g property that holds object ID of the client who has executed the runbook and targetResources_JobId_g property that holds job ID of the runbook executed.

4. Next I have used the object ID of the client who has executed the runbook that is mentioned at clientInfo_ObjectId_g property in Get-AzureADUser cmdlet to get name of the member who has executed the runbook and I have used the job ID that is mentioned at targetResources_JobId_g property in Get-AzAutomationJob cmdlet to get the name of the runbook. For illustration on how to use the cmdlets, please check below screenshot.

5. Next, as we were able to get the information about who has executed the runbook and which runbook was executed after sending logs to Log Analytics workspace so all you have to do is, run the below code as a script or as another runbook to get details of who has executed a runbook and which runbook was executed in a given time frame.

Below is the code for the same which basically uses Invoke-AzOperationalInsightsQuery, Get-AzureADUser and Get-AzAutomationJob cmdlets. It's just a sample code and you may tweak it as per your needs.

$query = 'AzureDiagnostics | where ResourceProvider == "MICROSOFT.AUTOMATION" and Category == "AuditEvent"'
$queryResults = Invoke-AzOperationalInsightsQuery -WorkspaceId <LogAnalyticsWorkspaceID> -Query $query -Timespan (New-TimeSpan -Hours 24)
$JobID = $queryResults.Results.targetResources_JobId_g
$ClientObjectID = $queryResults.Results.clientInfo_ObjectId_g
$AAResourceGroupName = $queryResults.Results.ResourceGroup
$AAResourceName = $queryResults.Results.Resource
$AADUserDetails = Get-AzureADUser -ObjectId $ClientObjectID
$RunbookExecutedBy = $AADUserDetails.DisplayName
$AAJobDetails = Get-AzAutomationJob -Id $JobID -ResourceGroupName $AAResourceGroupName -AutomationAccountName $AAResourceName
$RunbookName = $AAJobDetails.RunbookName
$RunbookExecutedBy
$RunbookName

I have tried all this for Automation accounts and Log Analytics workspaces in various regions. If you still face issue then please let me know which region your Automation Account and Log analytics workspace are from, what's the pricing tier and access control mode of your Log Analytics workspace and any other information to explain the context and environment setup better so I can try to reproduce the issue by creating similar environment.

Answer 2

Yes, there is a way to track the executions of runbooks and obtain information about who executed them in an Azure Automation account. You can enable diagnostic settings for your Automation account to capture the necessary logs and information

You can follow this link to setup: You can follow this link to setup: https://learn.microsoft.com/en-us/azure/automation/automation-manage-send-joblogs-log-analytics

Please Mark as Answer if this helps :)